CVE-2026-83813 in Twisted
Summary
by MITRE • 10/24/2026
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet to the resolver's listening port with the correct transaction ID can inject a forged answer. The standard twisted.names.client.Resolver uses a new random source port for each query, increasing off-path attack complexity, while applications that reuse a DNSDatagramProtocol instance expose only the transaction-ID search space after the first query. A successful forgery can redirect hostname resolution and enable mail interception, server-side request forgery, or man-in-the-middle positioning. This issue is fixed in version 26.10.0rc1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified in Twisted versions prior to 26.10.0rc1 resides within the DNSDatagramProtocol class of the twisted.names.dns module, specifically affecting how UDP-based Domain Name System responses are processed. The core technical flaw is a lack of source address verification during response validation. While the implementation correctly checks that the transaction ID in an incoming UDP packet matches the identifier associated with a pending query, it fails to verify whether the packet originated from the specific IP address and port combination that was queried. This design oversight creates a significant security gap because DNS over UDP relies on the assumption that responses will come from the expected destination, but does not inherently enforce this constraint at the application layer if such checks are omitted by the developer or framework implementation.
This flaw allows an attacker capable of delivering packets to the resolver's listening port to perform transaction ID guessing and injection attacks. By crafting a forged DNS response with the correct transaction ID, an adversary can trick the Twisted-based application into accepting malicious data as legitimate. The severity of this vulnerability is heavily influenced by the network context in which the vulnerable code operates. When using the standard twisted.names.client.Resolver class, each query utilizes a new random source port for every request. This practice significantly increases the complexity of an off-path attack because the attacker must successfully guess both the transaction ID and the ephemeral source port used by the resolver to send queries out. However, applications that instantiate and reuse a single DNSDatagramProtocol instance across multiple queries expose only the 16-bit transaction ID search space after the first query, as they may retain state or use consistent ports, thereby making successful forgery considerably easier for an attacker on the same network segment or with routing capabilities to intercept traffic.
The operational impact of successfully exploiting this vulnerability is severe and multifaceted. A successful DNS response injection enables a man-in-the-middle positioning where the attacker can redirect hostname resolution to malicious infrastructure. This capability facilitates several downstream attacks, including mail interception by resolving email server hostnames to attacker-controlled servers, thereby allowing for the eavesdropping or modification of sensitive communications. Furthermore, it can enable Server-Side Request Forgery scenarios if internal services are resolved through vulnerable resolvers, potentially exposing internal network resources that should not be accessible from external contexts. The ability to spoof DNS responses fundamentally undermines the integrity and authenticity guarantees expected in name resolution processes, leading to potential data breaches and unauthorized access depending on the specific application logic relying on these resolutions.
To mitigate this risk, organizations utilizing Twisted for internet applications must upgrade immediately to version 26.10.0rc1 or later, where the source address verification has been implemented to ensure responses are only accepted from the expected queried host and port. For environments that cannot yet upgrade, developers should review their DNS client implementations to ensure they adhere to best practices such as using random source ports for each query rather than reusing protocol instances in a manner that reduces entropy. Additionally, implementing DNSSEC validation at the application level or relying on external resolvers that enforce strict response verification can provide an additional layer of defense against these injection attacks. This vulnerability is categorized under CWE-287 Improper Authentication and aligns with ATT&CK techniques related to DNS Tunneling and Impair Defenses through cache poisoning, highlighting the critical need for robust validation in network-facing components.